PT-2026-20988 · Calibre · Calibre

0X5T · Publicado 2026-02-20 · Atualizado 2026-04-21 · CVE-2026-26064

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions calibre versions 9.2.1 and below

Description calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. A Path Traversal flaw exists in versions 9.2.1 and below, allowing arbitrary file writes where the user has write permissions. On Windows systems, this can lead to Remote Code Execution by writing a malicious payload to the Startup folder, which is then executed upon the next user login. The extract pictures function only verifies that file names start with 'Pictures' and does not properly sanitize '..' sequences. While calibre's ZipFile.extractall() function in utils/zipfile.py sanitizes '..' using get targetpath(), the extract pictures() function bypasses this protection by using manual zf.read() and open() operations.

Recommendations Update to calibre version 9.3.0 or later.

Exploit

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2026-04347

CVE-2026-26064

GHSA-72CH-3HQC-PGMP

OPENSUSE-SU-2026:10587-1

Produtos afetados

Calibre

Referências · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26064.json · Exploit
• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-72ch-3hqc-pgmp · Aviso do Fabricante
• https://github.com/kovidgoyal/calibre/commit/e1b5f9b45a5e8fa96c136963ad9a1d35e6adac62 · Correção
• https://ubuntu.com/security/CVE-2026-26064 · Aviso do Fabricante
• https://t.me/cveNotify/152556 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2026-25635 · Nota
• https://twitter.com/TheHackerWire/status/2024912115388350585 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-04347 · Nota de Segurança
• https://suse.com/security/cve/CVE-2026-26064 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-26064 · Nota de Segurança
• https://suse.com/security/cve/CVE-2026-27810 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-26064 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-26064 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26064 · Aviso do Fabricante
• https://t.me/CVEtracker/45223 · Publicação no Telegram